GRC 5.3 Access Control - Critical Alerts for permissions

We have successfully configured alerts for transactions, but we have not been able to generate any alerts to indicate when a user executes the transaction and makes a change. 
Should the risk containing the function be saved as Critical Action or Critical Permission?
How should the auth object be added to the function?
I have noticed when adding a transaction to a function 5.3 does not import the auth objects like VIRSA backend clients.  Is this correct or was something missed in the configuration?
Any help is appreciated.
Thanks,
Joe

Hi Pablo,
     AC 5.3 release will have it's first anniversary in second half of 2009 and it is far better product than AC 5.2. Trust me, and go with AC 5.3, you won't be disappointed. Products in AC 5.2 are very restrictive and you will get frustrated with RE for sure.
    The recommendations you provided came out of installation guide and other documents. These requirements are ok but I would not recommend you to go with them. Insted, it would be better to go through the sizing guiding and size your server accordingly.
   SAP used to have AC 5.2 sizing guide but they have removed it from SMP as they have replaced it with sizing guide for AC 5.3. Here is the link to the guide:
https://websmp203.sap-ag.de/~form/sapnet?_SHORTKEY=00200797470000071612&_SCENARIO=01100035870000000112&_OBJECT=011000358700000435122007E
If you still want to go with AC 5.2 then open a message with SAP and they can provide you. I even has that guide so if you want it, I can share it with you.
Regards,
Alpesh
SAP GRC Manager (PwC)

Similar Messages

  • Netweaver 7.30 does it support GRC 10.0 ACCESS CONTROL

    Does anyone know if GRC 10.0 access control runs on Netweaver 7.30
    where do you get Netweaver 7.20
    I see the trial version. I need this for sql 2008 not trial
    Any help is appreciated.
    Thanks
    Joe

    Hi,
    As per Note 1490996, you would need Netweaver 7.0 Enhancement Package 2 (7.02) as base for installing the GRC add-on. NW 730 does not seem to be supported.
    Check the service market place(http://service.sap.com/swdc) for Netweaver 7.02 and not 720.
    Regards,
    Srikishan

  • Cannot Clear Critical Alert for Physical Standby Databases

    10.2.0.4.0 Grid Control monitoring 10.2.0.4.0 databases and standby databases with 10.2.0.4.0 agents.
    The standby databases are running on Xen guests. The O/S is Red Hat 4 Advanced Server.
    I had a failure of Xen guest on Saturday that caused me to have to rebuild the standby servers. EM Grid Control successfully verifies the configurations and the status is normal for both physical standby databases. (A rebuilt logical standby database shows no alerts.)
    Grid Control database targets page shows a single critical alert for each physical standby database. The alert is for "number of missing media files is 4". The metric graph shows the count as 0 since before the rebuilds. I cannot clear the alerts from the Critical Alerts page. Grid Control reports "The selected alert(s) cannot be manually cleared. They will clear automatically once the metric is no longer in a critical or warning state.".
    Any suggestions?
    Thanks,
    Ray Westphal

    Thanks for the reply Anthony.
    The result of the query on both standby databases is '0'. The metric graph also shows the value at '0' since before rebuilds.
    And the OMS db and agents have been reset several times since I posted this.
    Ray Westphal.

  • "Assign Access Control" returns error for essbase apps in shared services

    Hello,
    I installed and configured Oracle EPM 11.1.2 (Foundation, Essbase, Planning, Reporting&Analysis):
    OS: Windows Server 2008 Sp2 (32bit)
    Default Installation with default ports,
    Installation of all components on the same server,
    no clustering
    EPM System Diagnostic says that everything is OK.
    Now I want to assign filter access for an essbase database in the Shared Services.
    Starting the menu item "Assign Access Control" in Shared Services returns the following error:
    Error 404--Not Found
    From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
    +10.4.5 404 Not Found+
    The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent.
    +....+
    Can anybody help ???
    best regards,
    Nicole

    Hello,
    here's what I found out so far:
    I get the error if I start the shared services console via the URL "http://servername:port/interop/index.jsp" and then select the "assign access control" for an essbase database.
    If I start the shared services console via the workspace everything works fine.
    Does anybody know what to do so that it also works if I start the shared services console via URL?
    best regards,
    Nicole

  • Airport time access control not working for iPhones-

    Hi,
    I use a 3rd generation Airport Extreme base for my WiFi hme network.
    For parental control, I'd like to allow one iPhone and iMac to be connected only for some hours of the day.
    So I have activated the timed access control and entered the relevant MAC addresses and the time to be connected.
    It seems that the iMac is well restricted as it should, but the iPhone has no limitation…
    Why is it not effective for the iPhone ? The iPhone MAC address (Wi-Fi Address) doen't work in this case ?
    (I have Lion up to date)
    Thanks for your help
    Eric

    Sorry, my fault:
    I wrote the Bluetooth adress instead of the WiFi address…
    It works perfectly now for me

  • Cisco Secure Access Control Server (ACS) for Windows

    Looking for Part code for client of ACS 3.1, needs CD-ROM for re-installation prior to considering upgrade.

    It should be
    CSACS31WINK9
    M.
    Hope that helps rate if it does

  • How to provide access to Critical Transactions in GRC AC 10.0

    +Hello Gurus,+
    +We are in phase of implementing GRC AC 10.0 , and have a requirement where there are "Critical Transactions" identified by the Business and if there is any end user who wants to access any specific "Critical Transaction" e.g. PA30 etc then it must automatically go to a specific Owner of that transaction.+
    +As far as i know , we can have a workflow for getting a role assigned, but not sure if it is possible to have a workflow where every "critical transaction" will have an owner and then on selection of the transaction it will trigger a workflow.+
    +I would also like to know what is a standard or rather best practice in SAP GRC , regarding providing access to "CRITICAL Transactions" ??+
    +We thought of creating a role containing multiple "Critical transactions" and then assigning to the firefighter ID , for which we have an approval workflow !! But that does not help , as assigning the role will give user access to some other "critical transactions" as well which we would like to control.+
    +Looking forward to know about the suggestion/solution for this issue.+
    +Thanks in advance.+
    +Regards,+
    +Victor+

    Hello,
    Victor Ger wrote:
    > +We thought of creating a role containing multiple "Critical transactions" and then assigning to the firefighter ID , for which we have an approval workflow !! But that does not help , as assigning the role will give user access to some other "critical transactions" as well which we would like to control.+
    > +Victor+
    I think that only one firefighter with all the critical transactions is not a good idea. I guess it's better to have different firefighters IDs assigned to different users. The point here is to decide if you really want to have a trace for all critical transactions executions.
    An example:
    Tx. SM37 is considered a critical transaction if the user has also the auth. object S_BTCH_ADM set to "yes".  This allows to delete or copy others user's jobs. This is and authorization that a Basis person must have. Do you really want to trace this?
    I think that force a Basis person to use a firefighter for this is nonsense, because this tx. is part of his/her job. Then, you should accept this sort of risks, otherwise you'll get the point where you replace the normal users with FF users. This is not the idea of FF.
    Of course, this is just a thought and all depends on your business requirements.
    Cheers,
    Diego.

  • Change in Access Control components on the Service Marketplace

    Hello GRC community:
    We would like to inform you that as of yesterday (5/30) the Access Control components for support messages/SAP Notes have been changed (they have actually been replaced so all messages/notes logged under the old component will be moved/replaced to the new).
    The main 4 components are now:
    New: GRC-SAC-ARA     Access Risk Management
    Old: GRC-SAC-SCC          Risk Analysis & Remediation (formerly Compliance Calibrator) 
    New: GRC-SAC-ARQ     Access Request
    Old: GRC-SAC-SAE          Compliant User Provisoning (formerly  Virsa Access Enforcer) 
    New: GRC-SAC-EAM     Emergency Access Management
    Old: GRC-SAC-SFF          Superuser Privilege Management (formerly Virsa Firefighter) 
    New: GRC-SAC-BRM     Business Role Management
    Old: GRC-SAC-SRE          Enterprise Role Management (formerly Virsa Role Expert)
    There are also NEW components specific to areas of functionality. If you are not sure of what component to log your message under, please use the main components above.
    GRC-SAC-ADS          Directory Services
    GRC-SAC-BI             Access Control BW
    GRC-SAC-CONF       Configuration
    GRC-SAC-DAS          Dashboard
    GRC-SAC-REP          Repository
    GRC-SAC-RPT          Reporting
    GRC-SAC-UAR          User Access Review
    GRC-SAC-UPG          Installation & Upgrade
    GRC-SAC-WF           Workflow
    Ramelyn Paredes
    AGS Primary Support

    Hello COmmunity,
    To Summarise in Short: New features introduced to V10.0 : GRC 10.0 is ABAP based, so extraction of data from users is fast & analysis as well.
    As usual, the names for the Access control tool has been changed
    A. Access Risk Analysis (RAR)
    1. USOBT & object information will be automatically updated with GRC rather than manual upload (earlier version)
    2. Mass Users can be imported from .CSV file for risk analysis, Role analysis etc.,
    3. Variant creation / reuse for any report analysis
    4. Option of having multiple rule sets & simulating users across multiple rule sets at same time
    5. Risk analysis for CUA, Composite roles
    6. Mitigation by system, risk id, mass mitigation for users, audit trail etc.,
    7. Risk analysis for HR objects
    B. Emergency Access Management (SPM)
    1. Mass reporting for all FF users, Ids, Executions
    2. Centrally maintained for all systems rather than individual ERPs.
    C. User Access Management (CUP)
    1. Customizable Access request forms
    2. HR based role assignment for position, org unit
    3. IDM integration using GRC Web services
    D. Business Role Management (ERM)
    1. Concept of Business role mapping for Technical roles.
    2. Audit Trails & PFCG Change history.
    Finally, the look, reporting format has been changed to provide additional information for analysis.
    More important - GRC V5.3 support is till 2015 & SAP has planned to push the customers to upgrade to 10.0. Eventually SAP is also planning to release GRC 11.0 by mid next year. So we have to wait & watch the show

  • OSB - ALSB / WLST / Security / add entry with WLST in  Access Control

    Hello,
    I try to reproduce with WLST script the input from the consol to declare user on Access Control proxy (security).
    sbconsol->$Proxy Service->Security->General Confiruration->Access Control->Transport Access Control->Add Conditions
    * First implementation without success with the com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean : accessControlSecurity1()
    * Second try with the service definition of the proxy service but cannot parse with Xpath accessControl Security2()
    any idee ???
    test case :
    prerequisit
    create an ALSB domain 10.3 (admin one with username='weblogic' password='weblogic' url='t3://localhost:7001') and create a proxy service on the default project
    conf/setEnv.cmd
    @CLS
    @echo ON
    @set BEA_HOME=D:\PRODUCT\MIDDLEWARE\SOA\OSB_10.3
    @set WL_HOME=%BEA_HOME%\wlserver_10.3
    @set OSB_HOME=%BEA_HOME%\osb_10.3
    @set SCRIPTING_HOME=E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security
    @set OSB_LIB=%OSB_HOME%/lib/sb-kernel-api.jar;%BEA_HOME%/modules/com.bea.alsb.statistics_1.0.1.0.jar;%OSB_HOME%/lib/sb-kernel-resources.jar;%OSB_HOME%/lib/sb-kernel-common.jar;%OSB_HOME%/lib/sb-kernel-impl.jar;%OSB_HOME%\lib\sb-security.jar;%OSB_HOME%/modules/com.bea.common.configfwk_1.3.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.1.0.jar;%OSB_HOME%/lib/modules/com.bea.alsb.resources.archive.jar;
    @set TOOL_LIB=%SCRIPTING_HOME%\lib\log4j-1.2.15.jar;%SCRIPTING_HOME%\lib\jsch-0.1.43.jar;%SCRIPTING_HOME%\lib\db2jcc.jar
    @set CLASSPATH=%OSB_LIB%;%TOOL_LIB%;%CLASSPATH%
    @set CLASSPATH=%SCRIPTING_HOME%\lib\db2jcc.jar;%TOOL_LIB%;%CLASSPATH%
    @set MODULE_LIB=%SCRIPTING_HOME%\lib
    @call %WL_HOME%\server\bin\setWLSEnv.cmd > nul 2<&1
    launch.cmd
    @CLS
    @echo OFF
    @SETLOCAL
    @call "conf\setEnv.cmd" > nul 2<&1
    set PWD=%~dp0
    %JAVA_HOME%\bin\java -Dmodule.lib=%MODULE_LIB% weblogic.WLST -skipWLSModuleScanning lib/security.py
    lib/security.py
    from com.bea.wli.monitoring import StatisticType
    from java.util import HashMap
    from java.util import HashSet
    from java.util import ArrayList
    from java.util import Collections
    from java.io import FileInputStream
    from java.io import FileOutputStream
    from java.lang import String
    from java.lang import Boolean
    from com.bea.wli.sb.util import EnvValueTypes
    from com.bea.wli.config.env import EnvValueQuery;
    from com.bea.wli.config import Ref
    from com.bea.wli.config.customization import Customization
    from com.bea.wli.config.customization import EnvValueCustomization
    from com.bea.wli.config.customization import FindAndReplaceCustomization
    from com.bea.wli.sb.management.configuration import SessionManagementMBean
    from com.bea.wli.sb.management.configuration import ALSBConfigurationMBean
    from com.bea.wli.sb.management.query import BusinessServiceQuery
    from com.bea.wli.sb.management.query import ProxyServiceQuery
    from com.bea.wli.sb.management.configuration import ServiceConfigurationMBean
    import os
    # before, create an ALSB domain 10.3 with a proxy service in the default project and add an Acces Control Policy in the consol
    # sbconsol->Project Explorer->default->${proxy service}->Security->Access Control->Create Session->Add Conditions->User->USR_1->Add
    # when we try to modify the Acces Control Policy of the proxy service with the ServiceSecurityConfigurationMBean
    def accessControlSecurity1( domain_name ):
              # connection
              print "\n\n\n***********************************************************************************************"
              connect( 'weblogic', 'weblogic', 't3://localhost:7001')
              domainRuntime()
              # create a session
              sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
              SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
              SessionMBean.createSession(sessionName)
              # get the ServiceSecurityConfigurationMBean
              serviceSecurityConfigurationMBean = findService(String("ServiceSecurityConfiguration.").concat(sessionName), "com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean")
              # get the XACMLAuthorizer
              working_directory=pwd()
              serverConfig()
              xacmlAuthorizer = cd('/SecurityConfiguration/%s/Realms/myrealm/Authorizers/XACMLAuthorizer' % domain_name )
              cd(working_directory)
              domainRuntime()
              # get service ref
              ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")
              bsQuery = ProxyServiceQuery()
              bsQuery.setPath("default/*")
              refs = ConfigurationMBean.getRefs(bsQuery)
              for ref in refs:
                   print 'ref=%s'%ref               
                   # use the security Mbean to add : USER_A,USER_B,USER_C to the policy
                   policyHolder = serviceSecurityConfigurationMBean.newAccessControlPolicyHolderInstance(xacmlAuthorizer)
                   policyHolder.setPolicyExpression("Usr(USER_A,USER_B,USER_C)")     
                   policyScope = serviceSecurityConfigurationMBean.newDefaultMessagePolicyScope(ref)
                   serviceSecurityConfigurationMBean.setAccessControlPolicy(policyScope,policyHolder)
                   # print the service definition
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   print serviceDefinition
                   # we can see the security entry in the service definition has follow
                   # <xml-fragment xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
                   # <ser:coreEntry isProxy="true" isEnabled="true" isAutoPublish="false">
                   # <ser:description/>
                   # <ser:security>
                   # <con:access-control-policies xmlns:con="http://www.bea.com/wli/sb/services/security/config">
                   # <con:message-level-policies>
                   # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config">
                   # <con:policy provider-id="XACMLAuthorizer">
                   # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
                   # </con:policy>
                   # </con1:default-policy>
                   # </con:message-level-policies>
                   # </con:access-control-policies>
                   # </ser:security>
              # but when we commit
              SessionMBean.activateSession(sessionName, "description for session activation")
              # we got the following exception
              # Unexpected error: com.bea.wli.config.session.SessionConflictException
              # No stack trace available.
              # Problem invoking WLST - Traceback (innermost last):
              # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 246, in ?
              # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 105, in accessControlSecurity1
              # com.bea.wli.config.session.SessionConflictException: Conflicts for session SessionScript1363339726764
              # [Non-Critical] Concurrent Modification Conflicts
              # NONE
              # [Critical] Resources with validation errors
              # 1 - ProxyService test/PS_TEST_bis CannotCommit
              # + CannotCommit [OSB Security:386836]Unnecessary proxy wide message access control policy found for service "test/PS_TEST_bis". Hint: The service is neither an active security
              # intermediary nor has custom authentication enabled. ServiceDiagnosticLocation[SECURITY_TAB]:DiagnosticLocation:<con:message-level-policies xmlns:ser="http://www.bea.com/wli/sb/services" xml
              # ns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env" xmlns:con="http://www.bea.com/wli/sb/services/security/config">
              # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/
              # config">
              # <con:policy provider-id="XACMLAuthorizer">
              # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
              # </con:policy>
              # </con1:default-policy>
              # </con:message-level-policies>
              # [Info] Informational messages
              # NONE
              # at com.bea.wli.config.session.SessionManager.commitSessionUnlocked(SessionManager.java:358)
              # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:339)
              # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:297)
              # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:306)
              disconnect()                              
    # when we try to modify the Acces Control Policy of the proxy service whith the service XML definition
    def accessControlSecurity2( domain_name ):
              # connection
              print "\n\n\n***********************************************************************************************"
              connect( 'weblogic', 'weblogic', 't3://localhost:7001')
              domainRuntime()
              # create a session
              sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
              SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
              SessionMBean.createSession(sessionName)
              # get service ref
              ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
              bsQuery = ProxyServiceQuery()
              bsQuery.setPath("default/*")
              refs = ConfigurationMBean.getRefs(bsQuery)
              for ref in refs:
                   print 'ref=%s'%ref
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   # parsing the proxy definition
                   nsSer = "declare namespace ser='http://www.bea.com/wli/sb/services'"
                   nsXsi = "declare namespace xsi='http://www.w3.org/2001/XMLSchema-instance'"
                   nsTran = "declare namespace tran='http://www.bea.com/wli/sb/transports'"
                   nsEnv = "declare namespace env='http://www.bea.com/wli/config/env'"
                   nsCon = "declare namespace con='http://www.bea.com/wli/sb/services/security/config'"
                   nsCon1 = "declare namespace con1='http://www.bea.com/wli/sb/services/security/config'"
                   # when we try to parse the following Xpath Expression, it' working but not sufficent to access the <con:policy-expression> element
                   confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy"
                   confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
                   print "WORKING{%s}" % confElem
                   # get the result
                   # <xml-fragment xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config" xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
                   # <con:policy provider-id="XACMLAuthorizer">
                   # <con:policy-expression>Usr(USER_1,USER_2,USER_3)</con:policy-expression>
                   # </con:policy>
                   # </xml-fragment>
                   # and when we try to acces the <con:policy> element whith the following Xpath expression we got an empty result
                   confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy/con:policy"
                   confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
                   print "DON'T WORKING{%s}" % confElem
                   # get empty result
                   # array([], org.apache.xmlbeans.XmlObject)
              # want to modify the value like this on the <con:policy-expression> but cannot reach it ...
              #confValue="Usr(USER_A,USER_B,USER_C)"
              #confElem.setStringValue(confValue)
              # commit                
              SessionMBean.activateSession(sessionName, "description for session activation")
              disconnect
    # print the service definition
    def printServiceDefinition( domain_name ):
              # connection
              connect( 'weblogic', 'weblogic', 't3://localhost:7001')
              domainRuntime()
              # create a session
              sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
              SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
              SessionMBean.createSession(sessionName)
              # get service ref
              ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
              bsQuery = ProxyServiceQuery()
              bsQuery.setPath("default/*")
              refs = ConfigurationMBean.getRefs(bsQuery)
              for ref in refs:
                   print 'ref=%s'%ref
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   print serviceDefinition
              # commit                
              SessionMBean.activateSession(sessionName, "description for session activation")
              disconnect
    #accessControlSecurity1('cluster_domain')
    accessControlSecurity2('cluster_domain')

    Hello,
    I try to reproduce with WLST script the input from the consol to declare user on Access Control proxy (security).
    sbconsol->$Proxy Service->Security->General Confiruration->Access Control->Transport Access Control->Add Conditions
    * First implementation without success with the com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean : accessControlSecurity1()
    * Second try with the service definition of the proxy service but cannot parse with Xpath accessControl Security2()
    any idee ???
    test case :
    prerequisit
    create an ALSB domain 10.3 (admin one with username='weblogic' password='weblogic' url='t3://localhost:7001') and create a proxy service on the default project
    conf/setEnv.cmd
    @CLS
    @echo ON
    @set BEA_HOME=D:\PRODUCT\MIDDLEWARE\SOA\OSB_10.3
    @set WL_HOME=%BEA_HOME%\wlserver_10.3
    @set OSB_HOME=%BEA_HOME%\osb_10.3
    @set SCRIPTING_HOME=E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security
    @set OSB_LIB=%OSB_HOME%/lib/sb-kernel-api.jar;%BEA_HOME%/modules/com.bea.alsb.statistics_1.0.1.0.jar;%OSB_HOME%/lib/sb-kernel-resources.jar;%OSB_HOME%/lib/sb-kernel-common.jar;%OSB_HOME%/lib/sb-kernel-impl.jar;%OSB_HOME%\lib\sb-security.jar;%OSB_HOME%/modules/com.bea.common.configfwk_1.3.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.0.0.jar;%BEA_HOME%/modules/com.bea.common.configfwk_1.2.1.0.jar;%OSB_HOME%/lib/modules/com.bea.alsb.resources.archive.jar;
    @set TOOL_LIB=%SCRIPTING_HOME%\lib\log4j-1.2.15.jar;%SCRIPTING_HOME%\lib\jsch-0.1.43.jar;%SCRIPTING_HOME%\lib\db2jcc.jar
    @set CLASSPATH=%OSB_LIB%;%TOOL_LIB%;%CLASSPATH%
    @set CLASSPATH=%SCRIPTING_HOME%\lib\db2jcc.jar;%TOOL_LIB%;%CLASSPATH%
    @set MODULE_LIB=%SCRIPTING_HOME%\lib
    @call %WL_HOME%\server\bin\setWLSEnv.cmd > nul 2<&1
    launch.cmd
    @CLS
    @echo OFF
    @SETLOCAL
    @call "conf\setEnv.cmd" > nul 2<&1
    set PWD=%~dp0
    %JAVA_HOME%\bin\java -Dmodule.lib=%MODULE_LIB% weblogic.WLST -skipWLSModuleScanning lib/security.py
    lib/security.py
    from com.bea.wli.monitoring import StatisticType
    from java.util import HashMap
    from java.util import HashSet
    from java.util import ArrayList
    from java.util import Collections
    from java.io import FileInputStream
    from java.io import FileOutputStream
    from java.lang import String
    from java.lang import Boolean
    from com.bea.wli.sb.util import EnvValueTypes
    from com.bea.wli.config.env import EnvValueQuery;
    from com.bea.wli.config import Ref
    from com.bea.wli.config.customization import Customization
    from com.bea.wli.config.customization import EnvValueCustomization
    from com.bea.wli.config.customization import FindAndReplaceCustomization
    from com.bea.wli.sb.management.configuration import SessionManagementMBean
    from com.bea.wli.sb.management.configuration import ALSBConfigurationMBean
    from com.bea.wli.sb.management.query import BusinessServiceQuery
    from com.bea.wli.sb.management.query import ProxyServiceQuery
    from com.bea.wli.sb.management.configuration import ServiceConfigurationMBean
    import os
    # before, create an ALSB domain 10.3 with a proxy service in the default project and add an Acces Control Policy in the consol
    # sbconsol->Project Explorer->default->${proxy service}->Security->Access Control->Create Session->Add Conditions->User->USR_1->Add
    # when we try to modify the Acces Control Policy of the proxy service with the ServiceSecurityConfigurationMBean
    def accessControlSecurity1( domain_name ):
              # connection
              print "\n\n\n***********************************************************************************************"
              connect( 'weblogic', 'weblogic', 't3://localhost:7001')
              domainRuntime()
              # create a session
              sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
              SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
              SessionMBean.createSession(sessionName)
              # get the ServiceSecurityConfigurationMBean
              serviceSecurityConfigurationMBean = findService(String("ServiceSecurityConfiguration.").concat(sessionName), "com.bea.wli.sb.security.management.configuration.ServiceSecurityConfigurationMBean")
              # get the XACMLAuthorizer
              working_directory=pwd()
              serverConfig()
              xacmlAuthorizer = cd('/SecurityConfiguration/%s/Realms/myrealm/Authorizers/XACMLAuthorizer' % domain_name )
              cd(working_directory)
              domainRuntime()
              # get service ref
              ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")
              bsQuery = ProxyServiceQuery()
              bsQuery.setPath("default/*")
              refs = ConfigurationMBean.getRefs(bsQuery)
              for ref in refs:
                   print 'ref=%s'%ref               
                   # use the security Mbean to add : USER_A,USER_B,USER_C to the policy
                   policyHolder = serviceSecurityConfigurationMBean.newAccessControlPolicyHolderInstance(xacmlAuthorizer)
                   policyHolder.setPolicyExpression("Usr(USER_A,USER_B,USER_C)")     
                   policyScope = serviceSecurityConfigurationMBean.newDefaultMessagePolicyScope(ref)
                   serviceSecurityConfigurationMBean.setAccessControlPolicy(policyScope,policyHolder)
                   # print the service definition
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   print serviceDefinition
                   # we can see the security entry in the service definition has follow
                   # <xml-fragment xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
                   # <ser:coreEntry isProxy="true" isEnabled="true" isAutoPublish="false">
                   # <ser:description/>
                   # <ser:security>
                   # <con:access-control-policies xmlns:con="http://www.bea.com/wli/sb/services/security/config">
                   # <con:message-level-policies>
                   # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config">
                   # <con:policy provider-id="XACMLAuthorizer">
                   # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
                   # </con:policy>
                   # </con1:default-policy>
                   # </con:message-level-policies>
                   # </con:access-control-policies>
                   # </ser:security>
              # but when we commit
              SessionMBean.activateSession(sessionName, "description for session activation")
              # we got the following exception
              # Unexpected error: com.bea.wli.config.session.SessionConflictException
              # No stack trace available.
              # Problem invoking WLST - Traceback (innermost last):
              # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 246, in ?
              # File "E:\PROJETS\RECURANT\EDF\linky\WLST\WORKING\Security\lib\security.py", line 105, in accessControlSecurity1
              # com.bea.wli.config.session.SessionConflictException: Conflicts for session SessionScript1363339726764
              # [Non-Critical] Concurrent Modification Conflicts
              # NONE
              # [Critical] Resources with validation errors
              # 1 - ProxyService test/PS_TEST_bis CannotCommit
              # + CannotCommit [OSB Security:386836]Unnecessary proxy wide message access control policy found for service "test/PS_TEST_bis". Hint: The service is neither an active security
              # intermediary nor has custom authentication enabled. ServiceDiagnosticLocation[SECURITY_TAB]:DiagnosticLocation:<con:message-level-policies xmlns:ser="http://www.bea.com/wli/sb/services" xml
              # ns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env" xmlns:con="http://www.bea.com/wli/sb/services/security/config">
              # <con1:default-policy xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/
              # config">
              # <con:policy provider-id="XACMLAuthorizer">
              # <con:policy-expression>Usr(USER_A,USER_B,USER_C)</con:policy-expression>
              # </con:policy>
              # </con1:default-policy>
              # </con:message-level-policies>
              # [Info] Informational messages
              # NONE
              # at com.bea.wli.config.session.SessionManager.commitSessionUnlocked(SessionManager.java:358)
              # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:339)
              # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:297)
              # at com.bea.wli.config.session.SessionManager.commitSession(SessionManager.java:306)
              disconnect()                              
    # when we try to modify the Acces Control Policy of the proxy service whith the service XML definition
    def accessControlSecurity2( domain_name ):
              # connection
              print "\n\n\n***********************************************************************************************"
              connect( 'weblogic', 'weblogic', 't3://localhost:7001')
              domainRuntime()
              # create a session
              sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
              SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
              SessionMBean.createSession(sessionName)
              # get service ref
              ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
              bsQuery = ProxyServiceQuery()
              bsQuery.setPath("default/*")
              refs = ConfigurationMBean.getRefs(bsQuery)
              for ref in refs:
                   print 'ref=%s'%ref
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   # parsing the proxy definition
                   nsSer = "declare namespace ser='http://www.bea.com/wli/sb/services'"
                   nsXsi = "declare namespace xsi='http://www.w3.org/2001/XMLSchema-instance'"
                   nsTran = "declare namespace tran='http://www.bea.com/wli/sb/transports'"
                   nsEnv = "declare namespace env='http://www.bea.com/wli/config/env'"
                   nsCon = "declare namespace con='http://www.bea.com/wli/sb/services/security/config'"
                   nsCon1 = "declare namespace con1='http://www.bea.com/wli/sb/services/security/config'"
                   # when we try to parse the following Xpath Expression, it' working but not sufficent to access the <con:policy-expression> element
                   confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy"
                   confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
                   print "WORKING{%s}" % confElem
                   # get the result
                   # <xml-fragment xsi:type="con:ProviderPolicyContainerType" xmlns:con="http://www.bea.com/wli/sb/security/accesscontrol/config" xmlns:con1="http://www.bea.com/wli/sb/services/security/config" xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env">
                   # <con:policy provider-id="XACMLAuthorizer">
                   # <con:policy-expression>Usr(USER_1,USER_2,USER_3)</con:policy-expression>
                   # </con:policy>
                   # </xml-fragment>
                   # and when we try to acces the <con:policy> element whith the following Xpath expression we got an empty result
                   confPath = "ser:coreEntry/ser:security/con:access-control-policies/con1:transport-level-policy/con:policy"
                   confElem = serviceDefinition.selectPath(nsSer + nsXsi + nsTran + nsEnv + nsCon + nsCon1 + confPath )
                   print "DON'T WORKING{%s}" % confElem
                   # get empty result
                   # array([], org.apache.xmlbeans.XmlObject)
              # want to modify the value like this on the <con:policy-expression> but cannot reach it ...
              #confValue="Usr(USER_A,USER_B,USER_C)"
              #confElem.setStringValue(confValue)
              # commit                
              SessionMBean.activateSession(sessionName, "description for session activation")
              disconnect
    # print the service definition
    def printServiceDefinition( domain_name ):
              # connection
              connect( 'weblogic', 'weblogic', 't3://localhost:7001')
              domainRuntime()
              # create a session
              sessionName = String("SessionScript"+Long(System.currentTimeMillis()).toString())
              SessionMBean = findService( SessionManagementMBean.NAME ,SessionManagementMBean.TYPE)
              SessionMBean.createSession(sessionName)
              # get service ref
              ConfigurationMBean = findService(String("ALSBConfiguration.").concat(sessionName), "com.bea.wli.sb.management.configuration.ALSBConfigurationMBean")               
              bsQuery = ProxyServiceQuery()
              bsQuery.setPath("default/*")
              refs = ConfigurationMBean.getRefs(bsQuery)
              for ref in refs:
                   print 'ref=%s'%ref
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   servConfMBean = findService( "%s.%s" % (ServiceConfigurationMBean.NAME, sessionName), ServiceConfigurationMBean.TYPE)
                   serviceDefinition = servConfMBean.getServiceDefinition(ref)
                   print serviceDefinition
              # commit                
              SessionMBean.activateSession(sessionName, "description for session activation")
              disconnect
    #accessControlSecurity1('cluster_domain')
    accessControlSecurity2('cluster_domain')

  • Cannot display Access Control Rules page --- BUG REPORT

    iWS 4.1sp9 on Linux Admin GUI cannot display Access Control Rules page for Netscape browsers 4.7 and 6.2 or for IE 4.
    It does work for IE 5.5 (running this in Vmware).
    I'm reporting this bug here as I can't see anywhere else to put it.

    It could be a firmware bug, or it could be something else bugging out. If the router hasn't been factory reset and it's been through a few firmware upgrades, try resetting it to factory defaults. Take note of any custom settings you have, so you can go in and manually re-configure the router. I would avoid importing a backed up config file in case the config turns out to be the problem, but it doesn't hurt to download a copy of your config now.
    Give that a try. Others might have some more ideas.
    ========
    The first to bring me 1Gbps Fiber for $30/m wins!

  • HRMS Data access control

    Hi,
    Can fine grained access control (VPD) be used to implement access control security policy for HRMS sensitive data. The business requirement is that the HRMS data should not be visible to any querying tool other than Oracle applications core HRMS forms.
    What kind of a security policy be enforced to achive this and are there any compatibility issues/limitations of this.
    Thanks in advance,
    Regards,
    Mahesh
    null

    you are right, access control is very application dependent, and is therefore not a good target to turn into a generic framework.
    In my opinion the king of security frameworks is Spring Security, so you could take a look at that.
    [http://static.springsource.org/spring-security/site/|http://static.springsource.org/spring-security/site/]
    Other than that, I have used a simple setup using Javaserver Faces. I had a user bean with a set of boolean flags indicating the user's capabilities (directly mapped to a database table) and in the components I would have rendered="#{user.userRole}" attributes where necessary, to conditionally switch off elements when the user wasn't allowed to see it, in some cases rendering a readonly view in stead.
    Its a chore to test, but quite easy to maintain and to read IMO.

  • EJB and access controll???

    Hi all,
    I have a question about access control via EJB,
    For example I have a client app�ication and on start I will prompt user for user name and password, and now what to do with this information how to pas it to the ejb server, or??? Or may be some of you have any link to tutorial as an answer? My EJB will access database and I want to use the access control from database.
    Thank you in advance.

    Hi Eshwa,
    thank you for your reply, I found a nice developer guide on the link that you give me, but I steal have a problem with undestanding of practical way to pas user information from client application to ejb server, may be you can give mi a pice of code or an small example, where is geted 2 String (user name and password) and sent to the ejb server to be autentificated, and then to have acces to the resources that is accessable for this user (discribed in the deployment description user - role).
    Anyway thank you again.
    Best regards Alexander Hincu .

  • Error GRC Access Control 10.0

    We have a problem when execute the next steps in GRC Access Control 10.0
    SPRO-->Governance, Risk and Compliance>Access Control--> Access Risk Analysis--> Batch RisK Analysis
    We applied the next note, but problem is the same.
    1563583 - SYSTEM_NO_TASK_STORAGE dump on AIX
    Category          
    ABAP Programming Error
    Runtime Errors    
    ASSERTION_FAILED
    ABAP Program      
    CL_GRRM_DASHBOARD_MENU_AUTH===CP
    Application Component  GRC-RM
    Date and Time     
    13.03.2013 11:50:04
    |Short text                                                                                   
    |
    |
    The ASSERT condition was violated.                                                       
    |
    |What happened?                                                                               
    |
    |
    In the running application program, the ASSERT statement recognized a                    
    |
    |
    situation that should not have occurred.                                                 
    |
    |
    The runtime error was triggered for one of these reasons:                                
    |
    |
    - For the checkpoint group specified with the ASSERT statement, the                      
    |
    | 
    activation mode is set to "abort".                                                     
    |
    |
    - Via a system variant, the activation mode is globally set to "abort"                   
    |
    | 
    for checkpoint groups in this system.                                                  
    |
    |
    - The activation mode is set to "abort" on program level.                                
    |
    |
    - The ASSERT statement is not assigned to any checkpoint group.                          
    |
    |What can you do?                                                                             
    |
    |
    Note down which actions and inputs caused the error.                                     
    |
    |                                                                                             
    |
    |                                                                                             
    |
    |
    To process the problem further, contact you SAP system                                   
    |
    |
    administrator.                                                                           
    |
    |                                                                                             
    |
    |
    Using Transaction ST22 for ABAP Dump Analysis, you can look                              
    |
    |
    at and manage termination messages, and you can also                                     
    |
    |
    keep them for a long time.                                                               
    |
    |Error analysis                                                                               
    |
    |
    The following checkpoint group was used: "No checkpoint group specified"                 
    |
    |                                                                                             
    |
    |
    If in the ASSERT statement the addition FIELDS was used, you can find                    
    |
    |
    the content of the first 8 specified fields in the following overview:                   
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |
    " (not used) "                                                                           
    |
    |How to correct the error                                                                     
    |
    |
    Probably the only way to eliminate the error is to correct the program.                  
    |
    |
    |
    |                                                                                             
    |
    |
    If the error occures in a non-modified SAP program, you may be able to                   
    |
    |
    find an interim solution in an SAP Note.                                                 
    |
    |
    If you have access to SAP Notes, carry out a search with the following                   
    |
    |
    keywords:                                                                                
    |
    |                                                                                             
    |
    |
    "ASSERTION_FAILED" " "                                                                   
    |
    |
    "CL_GRRM_DASHBOARD_MENU_AUTH===CP" or "CL_GRRM_DASHBOARD_MENU_AUTH===CM001"              
    |
    |
    "IF_GRFN_MENU_ITEM_AUTH~IS_AUTHORIZED"                                                   
    |
    |                                                                                             
    |
    |
    If you cannot solve the problem yourself and want to send an error                       
    |
    |
    notification to SAP, include the following information:                                  
    |
    |                                                                                             
    |
    |
    1. The description of the current problem (short dump)                                   
    |
    |                                                                                             
    |
    |  
    To save the description, choose "System->List->Save->Local File                       
    |
    |
    (Unconverted)".                                                                          
    |
    |                                                                                             
    |
    |
    2. Corresponding system log                                                              
    |
    |                                                                                             
    |
    |  
    Display the system log by calling transaction SM21.                                   
    |
    |  
    Restrict the time interval to 10 minutes before and five minutes                      
    |
    |
    after the short dump. Then choose "System->List->Save->Local File                        
    |
    |
    (Unconverted)".                                                                          
    |
    |                                                                                             
    |
    |
    3. If the problem occurs in a problem of your own or a modified SAP                      
    |
    |
    program: The source code of the program                                                  
    |
    |  
    In the editor, choose "Utilities->More                                                
    |
    |
    Utilities->Upload/Download->Download".                                                   
    |
    |                                                                                             
    |
    |
    4. Details about the conditions under which the error occurred or which                  
    |
    |
    actions and input led to the error.                                                      
    |
    |                                                                                             
    |
    |                                                                                             
    |
    |System environment                                                                           
    |
    |
    SAP Release..... 702                                                                     
    |
    |
    SAP Basis Level. 0012                                                                    
    |
    |                                                                                             
    |
    |
    Application server... "KIO13701"                                                         
    |
    |
    Network address...... "172.20.1.137"                                                     
    |
    |
    Operating system..... "AIX"                                                              
    |
    |
    Release.............. "7.1"                                                              
    |
    |
    Hardware type........ "00F6C78E4C00"                                                     
    |
    |
    Character length.... 16 Bits                                                             
    |
    |
    Pointer length....... 64 Bits                                                            
    |
    |
    Work process number.. 10                                                                 
    |
    |
    Shortdump setting.... "full"                                                             
    |
    |                                                                                             
    |
    |
    Database server... "KIO13701"                                                            
    |
    |
    Database type..... "DB6"                                                                 
    |
    |
    Database name..... "DGR"                                                                 
    |
    |
    Database user ID.. "SAPDGR"                                                              
    |
    |                                                                                             
    |
    |
    Terminal.......... "192.168.0.5"                                                         
    |
    |                                                                                             
    |
    |
    Char.set.... "C"                                                                         
    |
    |                                                                                             
    |
    |
    SAP kernel....... 720                                                                    
    |
    |
    created (date)... "Jul 8 2012 19:43:01"                                                  
    |
    |
    create on........ "AIX 2 5 00092901D600"                                                 
    |
    |
    Database version. "DB6_81 "                                                              
    |
    |                                                                                             
    |
    |
    Patch level. 300                                                                         
    |
    |
    Patch text.. " "                                                                         
    |
    |                                                                                             
    |
    |
    Database............. "DB6 08.02.*, DB6 09.*, DB6 10.*"                                  
    |
    |
    SAP database version. 720                                                                
    |
    |
    Operating system..... "AIX 2 5, AIX 3 5, AIX 1 6, AIX 1 7"                               
    |
    |                                                                                             
    |
    |
    Memory consumption                                                                       
    |
    |
    Roll.... 0                                                                               
    |
    |
    EM...... 8379584                                                                         
    |
    |
    Heap.... 0                                                                               
    |
    |
    Page.... 16384                                                                           
    |
    |
    MM Used. 6205712                                                                         
    |
    |
    MM Free. 2170976                                                                         
    |
    |User and Transaction                                                                         
    |
    |
    Client.............. 100                                                                 
    |
    |
    User................ "LVELASCO"                                                          
    |
    |
    Language key........ "E"                                                                 
    |
    |
    Transaction......... " "                                                                 
    |
    |
    Transaction ID...... "51400164B1F00C40E1008000AC140189"                                  
    |
    |                                                                                             
    |
    |
    EPP Whole Context ID.... "5140015EB1F00C40E1008000AC140189"                              
    |
    |
    EPP Connection ID....... "5140F9B0B19C1150E1008000AC140189"                              
    |
    |
    EPP Caller Counter...... 1                                                               
    |
    |                                                                                             
    |
    |
    Program............. "CL_GRRM_DASHBOARD_MENU_AUTH===CP"                                  
    |
    |
    Screen.............. "SAPMHTTP 0010"                                                     
    |
    |
    Screen Line......... 2                                                                   
    |
    |
    Debugger Active..... "none"                                                              
    |
    |Server-Side Connection Information                                                           
    |
    |
    Information on Caller of "HTTPS" Connection:                                             
    |
    |
    Plug-in Type.......... "HTTPS"                                                           
    |
    |
    Caller IP............. "192.168.0.5"                                                     
    |
    |
    Caller Port........... 44300                                                             
    |
    |
    Universal Resource ID. "/sap/bc/webdynpro/sap/grfn_service_map"                          
    |
    |                                                                                             
    |
    |
    Program............. "CL_GRRM_DASHBOARD_MENU_AUTH===CP"                                  
    |
    |
    Screen.............. "SAPMHTTP 0010"                                                     
    |
    |
    Screen Line......... 2                                                                   
    |
    |                                                                                             
    |
    |
    Information on Caller ofr "HTTPS" Connection:                                            
    |
    |
    Plug-in Type.......... "HTTPS"                                                           
    |
    |
    Caller IP............. "192.168.0.5"                                                     
    |
    |
    Caller Port........... 44300                                                             
    |
    |
    Universal Resource Id. "/sap/bc/webdynpro/sap/grfn_service_map"                          
    |
    |Information on where terminated                                                              
    |
    |
    Termination occurred in the ABAP program "CL_GRRM_DASHBOARD_MENU_AUTH===CP" -            
    |
    |
    in "IF_GRFN_MENU_ITEM_AUTH~IS_AUTHORIZED".                                              
    |
    |
    The main program was "SAPMHTTP ".                                                        
    |
    |                                                                                             
    |
    |
    In the source code you have the termination point in line 59                             
    |
    |
    of the (Include) program "CL_GRRM_DASHBOARD_MENU_AUTH===CM001".                          
    |
    |Source Code Extract (Source code has changed)                                                
    |
    |Line |SourceCde                                                                              
    |
    |   29|   
    lv_dashboard = lv_value.                                                       
    |
    |   30|                                                                                       
    |
    |   31|   
    TRANSLATE lv_dashboard TO UPPER CASE.                                          
    |
    |   32|                                                                                       
    |
    |   33|   
    CASE lv_dashboard.                                                             
    |
    |   34|     
    WHEN 'HEATMAP'.                                                              
    |
    |   35|       
    lv_report = 'GRRM_HEATMAP'.                                                
    |
    |   36|                                                                                       
    |
    |   37|     
    WHEN 'LOSS_OVERVIEW' OR 'LOSS_STRUCTURE' OR 'OB_LOSS_OVERVIEW' OR 'OB_LOSS_STRUCTU|
    |   38|       
    lv_report = 'GRRM_LOSS_ANALYSIS'.                                          
    |
    |   39|                                                                                       
    |
    |   40|     
    WHEN 'OVERVIEW'.                                                             
    |
    |   41|       
    lv_report = 'GRRM_OVERVIEW'.                                               
    |
    |   42|                                                                                       
    |
    |   43|     
    WHEN OTHERS.                                                                 
    |
    |   44|       
    ASSERT 1 = 2.                                                              
    |
    |   45|                                                                                       
    |
    |   46|   
    ENDCASE.                                                                       
    |
    |   47|                                                                                       
    |
    |   48|   
    EXIT.                                                                          
    |
    |   49|                                                                                       
    |
    |   50| 
    ENDLOOP.                                                                         
    |
    |   51|                                                                                       
    |
    |   52|
    WHEN 'GRRM_LOSS_MATRIX' OR 'GRRM_LOSS_MATRIX_NEW'.                                 
    |
    |   53| 
    lv_report = 'GRRM_LOSS_ANALYSIS'.                                                
    |
    |   54|                                                                                       
    |
    |   55|
    WHEN 'GRRM_HEATMAP_REPORT'.                                                        
    |
    |   56| 
    lv_report = 'GRRM_HEATMAP'.                                                      
    |
    |   57|                                                                                       
    |
    |   58|
    WHEN OTHERS.                                                                       
    |
    |>>>>>| 
    ASSERT 1 = 2.                                                                    
    |
    |   60|                                                                                       
    |
    |   61|  ENDCASE.                                                                             
    |
    |   62|                                                                                       
    |
    |   63|  TRY.                                                                                 
    |
    |   64| 
    lv_regulation_id = cl_grfn_api_regulation=>if_grfn_api_regulation~get_regulation_id( i|
    |   65|                                                                                       
    |
    |   66| 
    ev_authorized = cl_grfn_util_rep_auth=>has_rep_auth(                             
    |
    |   67|   
    io_session  
    = io_session                                                  
    |
    |   68|   
    iv_regulation_id = lv_regulation_id                                            
    |
    |   69|   
    iv_report   
    = lv_report                                                   
    |
    |   70|   
    iv_activity 
    = grfn0_c_activity-print                                      
    |
    |   71| 
    |
    |   72|                                                                                       
    |
    |   73|
    CATCH cx_grfn_exception.                                                           
    |
    |   74| 
    ev_authorized = abap_false.                                                      
    |
    |   75|                                                                                       
    |
    |   76|  ENDTRY.                                                                              
    |
    |   77|                                                                                       
    |
    |   78|ENDMETHOD.                                                                             
    |
    |Contents of system fields                                                                    
    |
    |Name
    |Val.                                                                                
    |
    |SY-SUBRC|4                                                                                   
    |
    |SY-INDEX|2                                                                                   
    |
    |SY-TABIX|1                                                                                   
    |
    |SY-DBCNT|1                                                                                   
    |
    |SY-FDPOS|0                                                                                   
    |
    |SY-LSIND|0                                                                                   
    |
    |SY-PAGNO|0                                                                                   
    |
    |SY-LINNO|1                                                                                   
    |
    |SY-COLNO|1                                                                                   
    |
    |SY-PFKEY|                                                                                    
    |
    |SY-UCOMM|                                                                                    
    |
    |SY-TITLE|HTTP Control                                                                        
    |
    |SY-MSGTY|                                                                                    
    |
    |SY-MSGID|                                                                                    
    |
    |SY-MSGNO|000                                                                                 
    |
    |SY-MSGV1|                                                                                    
    |
    |SY-MSGV2|                                                                                    
    |
    |SY-MSGV3|                                                                                    
    |
    |SY-MSGV4|                                                                                    
    |
    |SY-MODNO|0                                                                                   
    |
    |SY-DATUM|20130313                                                                            
    |
    |SY-UZEIT|115004                                                                              
    |
    |SY-XPROG|SAPCNVE                                                                             
    |
    |SY-XFORM|CONVERSION_EXIT                                                                     
    |
    |Active Calls/Events                                                                          
    |
    |No.   Ty.     
    Program                        
    Include                        
    Line   |
    | 
    Name                                                                                   
    |
    |   34 METHOD  
    CL_GRRM_DASHBOARD_MENU_AUTH===CP
    CL_GRRM_DASHBOARD_MENU_AUTH===CM001
    59  |
    | 
    CL_GRRM_DASHBOARD_MENU_AUTH=>IF_GRFN_MENU_ITEM_AUTH~IS_AUTHORIZED                      
    |
    |   33 METHOD  
    CL_GRFN_API_MENU_ITEM_ELA=====CP
    CL_GRFN_API_MENU_ITEM_ELA=====CM001   126  |
    | 
    CL_GRFN_API_MENU_ITEM_ELA=>IF_GRFN_MENU_AUTH~ITEM_AUTH                                 
    |
    |   32 METHOD  
    CL_GRFN_API_MENU==============CP
    CL_GRFN_API_MENU==============CM003
    34  |
    | 
    CL_GRFN_API_MENU=>IF_GRFN_MENU_AUTH~ITEM_AUTH                                          
    |
    |   31 METHOD  
    CL_GRFN_LAUNCHPAD_UIBB========CP
    CL_GRFN_LAUNCHPAD_UIBB========CM006
    60  |
    | 
    CL_GRFN_LAUNCHPAD_UIBB=>IF_FPM_GUIBB_LAUNCHPAD~MODIFY                                  
    |
    |   30 METHOD  
    CL_FPM_LAUNCHPAD_UIBB_ASSIST==CP
    CL_FPM_LAUNCHPAD_UIBB_ASSIST==CM001
    76  |
    | 
    CL_FPM_LAUNCHPAD_UIBB_ASSIST=>INIT_FEEDER                                              
    |
    |   29 METHOD  
    /1BCWDY/T2POSMRSKMLY9L6LJP5Z==CP
    /1BCWDY/B_T2POSBAR6C8HPR0XTR4P   
    410  |
    | 
    CL_COMPONENTCONTROLLER_CTR=>WDDOINIT                                                   
    |
    | 
    Web Dynpro Component     
    FPM_LAUNCHPAD_UIBB                                       
    |
    | 
    Controller               
    COMPONENTCONTROLLER                                      
    |
    |   28 METHOD  
    /1BCWDY/T2POSMRSKMLY9L6LJP5Z==CP
    /1BCWDY/B_T2POSBAR6C8HPR0XTR4P   
    181  |
    | 
    CLF_COMPONENTCONTROLLER_CTR=>IF_WDR_COMPONENT_DELEGATE~WD_DO_INIT                      
    |
    | 
    Web Dynpro Component     
    FPM_LAUNCHPAD_UIBB                                       
    |
    | 
    Controller               
    COMPONENTCONTROLLER                                      
    |
    |   27 METHOD  
    CL_WDR_DELEGATING_COMPONENT===CP
    CL_WDR_DELEGATING_COMPONENT===CM004
    9  |
    | 
    CL_WDR_DELEGATING_COMPONENT=>DO_INIT                                                   
    |
    |   26 METHOD  
    CL_WDR_CONTROLLER=============CP
    CL_WDR_CONTROLLER=============CM00V
    3  |
    | 
    CL_WDR_CONTROLLER=>INIT_CONTROLLER                                                     
    |
    |   25 METHOD  
    CL_WDR_COMPONENT==============CP
    CL_WDR_COMPONENT==============CM019
    24  |
    | 
    CL_WDR_COMPONENT=>INIT_CONTROLLER                                                      
    |
    |   24 METHOD  
    CL_WDR_CONTROLLER=============CP
    CL_WDR_CONTROLLER=============CM002
    7  |
    | 
    CL_WDR_CONTROLLER=>INIT                                                                
    |
    |   23 METHOD  
    CL_WDR_CLIENT_COMPONENT=======CP
    CL_WDR_CLIENT_COMPONENT=======CM00E
    24  |
    | 
    CL_WDR_CLIENT_COMPONENT=>INIT                                                          
    |
    |   22 METHOD  
    CL_WDR_CLIENT_COMPONENT=======CP
    CL_WDR_CLIENT_COMPONENT=======CM00A
    42  |
    | 
    CL_WDR_CLIENT_COMPONENT=>IF_WDR_COMPONENT_FACTORY~CREATE_COMPONENT                     
    |
    |   21 METHOD  
    CL_WDR_COMPONENT_USAGE========CP
    CL_WDR_COMPONENT_USAGE========CM009
    67  |
    | 
    CL_WDR_COMPONENT_USAGE=>IF_WD_COMPONENT_USAGE~CREATE_COMPONENT                         
    |
    |   20 METHOD  
    CL_FPM_COMPONENT_MANAGER======CP
    CL_FPM_COMPONENT_MANAGER======CM003
    81  |
    | 
    CL_FPM_COMPONENT_MANAGER=>ADD_COMPONENT                                                
    |
    |   19 METHOD  
    CL_FPM_COMPONENT_MANAGER======CP
    CL_FPM_COMPONENT_MANAGER======CM004
    19  |
    | 
    CL_FPM_COMPONENT_MANAGER=>ATTACH_COMPONENT_TO_USAGE                                    
    |
    |   18 METHOD  
    CL_FPM========================CP
    CL_FPM========================CM005
    89  |
    | 
    CL_FPM=>PROCESS_EVENT                                                                  
    |
    |   17 METHOD  
    CL_FPM========================CP
    CL_FPM========================CM00C
    34  |
    | 
    CL_FPM=>RUN_EVENT_LOOP                                                                 
    |
    |   16 METHOD  
    CL_FPM========================CP
    CL_FPM========================CM002
    5  |
    | 
    CL_FPM=>IF_FPM~RAISE_EVENT                                                             
    |
    |   15 METHOD  
    CL_FPM========================CP
    CL_FPM========================CM003
    11  |
    |

    Hi Alberto,
    The below Notes should resolve!
    1428775
    1744179
    Hope this helps,
    Luciana

  • GRC Access Control licensing and Sizing

    Dear All,
    I am putting up a proposal for GRC Access Control. Could someone please help me with the calculation of licensing cost and the hardware requirements?
    1. Is the license cost totally driven by revenue ?
    2. Is there a flat base price plus number of user accounts?
    3. What sort of hardware config is required?
    Thanks,
    Aj

    Please ask your SAP account contact for pricing information.
    Frank.

  • Is Compliance Calibrator the same as GRC Access Control?

    I have been asked to look at<b> Compliance Calibrator </b>and am getting confused about what functionality is offered. I have done the basic e-learning course for Compliance Calibrator (GRC200): this was all about separation of duties etc. Fair enough. But I also have a Document called "<b>SAP GRC Access Control</b>" which talks about the same S.O.D compliance functionality but also talks of "roles triggering workflows", "users creating roles", "automated approvals for roles" eg:
    "SAP GRC Access Control streamlines access requests by filling each request automatically with user identity information from a lightweight directory access protocol (LDAP) directory or HR database, thereby eliminating the need for user intervention. Approvers receive an e-mail with a direct hyperlink to the request inside the application, where they can easily view and approve the request. The application then checks for security violations before updating accounts  automatically."
    None of this was covered on the Compliance Calibrator course, so what product offers this? I can see another product by Virsa called <b>Access Enforcer</b> but have no info on this... can anyone enlighten me?

    SAP GRC Access Control is the SAP application that comprises the former Virsa products Compliance Calibrator, Access Enforcer, Risk Terminator, Firefighter and Role Expert.

Maybe you are looking for